Issued:
2009-09-17
Updated:
2009-09-17

RHSA-2009:1451 - Security Advisory

Synopsis

Moderate: freeradius security update

Type/Severity

Security Advisory: Moderate

Topic

Updated freeradius packages that fix a security issue are now available for
Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

FreeRADIUS is a high-performance and highly configurable free Remote
Authentication Dial In User Service (RADIUS) server, designed to allow
centralized authentication and authorization for a network.

An input validation flaw was discovered in the way FreeRADIUS decoded
specific RADIUS attributes from RADIUS packets. A remote attacker could use
this flaw to crash the RADIUS daemon (radiusd) via a specially-crafted
RADIUS packet. (CVE-2009-3111)

Users of FreeRADIUS are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing the
update, radiusd will be restarted automatically.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 5.4 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.4 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.4 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.4 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.4 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 521912 - CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with zero length (DoS) -- re-appearance of CVE-2003-0967

CVEs

References

Red Hat Enterprise Linux Server 5

SRPM
freeradius-1.1.3-1.5.el5_4.src.rpm SHA-256: c8f36fbc30e9a52686957d20aa0dcdb8c3ded5f86409ca728dc7c950d7ca3fe3
x86_64
freeradius-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: 4940c3c318852a87f8217ca486646a90497539c570ba09dca162608f3af3a955
freeradius-mysql-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: c02ca767633052b56ac304ef59333a87e362263e37e2b3b6565a0ac246491710
freeradius-postgresql-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: af065769d08ae95121d67d6ebe3ad63b516ab1df32694fd68f2af8dac6be58a4
freeradius-unixODBC-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: 076d0d4215f43b761f8f4aa9afd08e10e88eac6a6df59e1a3ebf9ba74c0a59ed
ia64
freeradius-1.1.3-1.5.el5_4.ia64.rpm SHA-256: 0ac2ad50f78882def45fe303d661c6d75a035a06d092e125695379be6033be61
freeradius-mysql-1.1.3-1.5.el5_4.ia64.rpm SHA-256: ae8dbe50a4e19f0927dae831a33f202d11c3b98c6fc22a70885649dabe9df73f
freeradius-postgresql-1.1.3-1.5.el5_4.ia64.rpm SHA-256: 92a1f688ad4fdc7c1e45274defa237ad4125706e6d33a16571e870caa6e30468
freeradius-unixODBC-1.1.3-1.5.el5_4.ia64.rpm SHA-256: 30e43a8ef2e12b6244148aa31899ccf31e06685ff0cc2bec7a0d917981a7d554
i386
freeradius-1.1.3-1.5.el5_4.i386.rpm SHA-256: ec99ecd3a2220400632d827b7a57f4e25ea082565c9d5a4b2d53eeaa0ab1636b
freeradius-mysql-1.1.3-1.5.el5_4.i386.rpm SHA-256: b311b869253d27042dcd10a4464e8891ddfb4e2c240e192cb0898ce09cf4d528
freeradius-postgresql-1.1.3-1.5.el5_4.i386.rpm SHA-256: 9c1e1279e69bc3ec7ef31e6a52c35856dabf58e9d2189b300f81e25fc3dd7295
freeradius-unixODBC-1.1.3-1.5.el5_4.i386.rpm SHA-256: 05cce4c0b38dbd6b9a7ad19cc01b6f4f1ee1ad01e1245f40e25211fd996437ca

Red Hat Enterprise Linux Workstation 5

SRPM
freeradius-1.1.3-1.5.el5_4.src.rpm SHA-256: c8f36fbc30e9a52686957d20aa0dcdb8c3ded5f86409ca728dc7c950d7ca3fe3
x86_64
freeradius-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: 4940c3c318852a87f8217ca486646a90497539c570ba09dca162608f3af3a955
freeradius-mysql-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: c02ca767633052b56ac304ef59333a87e362263e37e2b3b6565a0ac246491710
freeradius-postgresql-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: af065769d08ae95121d67d6ebe3ad63b516ab1df32694fd68f2af8dac6be58a4
freeradius-unixODBC-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: 076d0d4215f43b761f8f4aa9afd08e10e88eac6a6df59e1a3ebf9ba74c0a59ed
i386
freeradius-1.1.3-1.5.el5_4.i386.rpm SHA-256: ec99ecd3a2220400632d827b7a57f4e25ea082565c9d5a4b2d53eeaa0ab1636b
freeradius-mysql-1.1.3-1.5.el5_4.i386.rpm SHA-256: b311b869253d27042dcd10a4464e8891ddfb4e2c240e192cb0898ce09cf4d528
freeradius-postgresql-1.1.3-1.5.el5_4.i386.rpm SHA-256: 9c1e1279e69bc3ec7ef31e6a52c35856dabf58e9d2189b300f81e25fc3dd7295
freeradius-unixODBC-1.1.3-1.5.el5_4.i386.rpm SHA-256: 05cce4c0b38dbd6b9a7ad19cc01b6f4f1ee1ad01e1245f40e25211fd996437ca

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
freeradius-1.1.3-1.5.el5_4.src.rpm SHA-256: c8f36fbc30e9a52686957d20aa0dcdb8c3ded5f86409ca728dc7c950d7ca3fe3
s390x
freeradius-1.1.3-1.5.el5_4.s390x.rpm SHA-256: 36b5c940f8c4a4afb524bb4fd2ee114f4a4e2c4a55fd48b481cf490412a89fb7
freeradius-mysql-1.1.3-1.5.el5_4.s390x.rpm SHA-256: da53d9187ac3421e823fd9454b50dfd4ecdde5a7341ccb1d4d47fef7d24cec90
freeradius-postgresql-1.1.3-1.5.el5_4.s390x.rpm SHA-256: 6a73a25b4c29b73c0983dc950dac817448d8a1b5f885a22560604080162579ce
freeradius-unixODBC-1.1.3-1.5.el5_4.s390x.rpm SHA-256: bfabcb6e836a7423f9837ff6801aa689db292a64f2e2fe1a7884e4080b125760

Red Hat Enterprise Linux for Power, big endian 5

SRPM
freeradius-1.1.3-1.5.el5_4.src.rpm SHA-256: c8f36fbc30e9a52686957d20aa0dcdb8c3ded5f86409ca728dc7c950d7ca3fe3
ppc
freeradius-1.1.3-1.5.el5_4.ppc.rpm SHA-256: f6bf87f8b4373e82c34f5d5f130310601218f171eec72c6f266640093108e557
freeradius-mysql-1.1.3-1.5.el5_4.ppc.rpm SHA-256: 4e78f23d17af977b9cf539f581c1f1cc090882852fe4f805dac9bd99081792cd
freeradius-postgresql-1.1.3-1.5.el5_4.ppc.rpm SHA-256: cb433789ba5f47b330d7705fd21508aaf5e64a4c90da64e592b080a05c18326d
freeradius-unixODBC-1.1.3-1.5.el5_4.ppc.rpm SHA-256: 4d51100792706cdcb4d7b8d8d4f96c4d97d19000309275f87b5c97ca0baa2aa0

Red Hat Enterprise Linux Server from RHUI 5

SRPM
freeradius-1.1.3-1.5.el5_4.src.rpm SHA-256: c8f36fbc30e9a52686957d20aa0dcdb8c3ded5f86409ca728dc7c950d7ca3fe3
x86_64
freeradius-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: 4940c3c318852a87f8217ca486646a90497539c570ba09dca162608f3af3a955
freeradius-mysql-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: c02ca767633052b56ac304ef59333a87e362263e37e2b3b6565a0ac246491710
freeradius-postgresql-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: af065769d08ae95121d67d6ebe3ad63b516ab1df32694fd68f2af8dac6be58a4
freeradius-unixODBC-1.1.3-1.5.el5_4.x86_64.rpm SHA-256: 076d0d4215f43b761f8f4aa9afd08e10e88eac6a6df59e1a3ebf9ba74c0a59ed
i386
freeradius-1.1.3-1.5.el5_4.i386.rpm SHA-256: ec99ecd3a2220400632d827b7a57f4e25ea082565c9d5a4b2d53eeaa0ab1636b
freeradius-mysql-1.1.3-1.5.el5_4.i386.rpm SHA-256: b311b869253d27042dcd10a4464e8891ddfb4e2c240e192cb0898ce09cf4d528
freeradius-postgresql-1.1.3-1.5.el5_4.i386.rpm SHA-256: 9c1e1279e69bc3ec7ef31e6a52c35856dabf58e9d2189b300f81e25fc3dd7295
freeradius-unixODBC-1.1.3-1.5.el5_4.i386.rpm SHA-256: 05cce4c0b38dbd6b9a7ad19cc01b6f4f1ee1ad01e1245f40e25211fd996437ca

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.